A Case Study on Testing for Software Security: Static Code Analysis of a File Reader Program Developed in Java

Introduction

Static Code Analysis is the process of examining a piece of code without actually executing it (McGraw, 2006). This allows the analyst to see everything that the code does and to consider the program as a whole, rather than just as a sequence of individual lines. Static Code Analysis (also invariably referred to as ‘Source Code Analysis’) is important from a software security standpoint. There are a number of issues which must be evaluated when performing a security analysis on a piece of code. Answering these questions (a sample is given below) can prove to be time-consuming for an analyst. Providing the right answers to these questions also requires a comprehensive knowledge of possible exploits and their solutions.

• •

  What is the basic design of this application?

• •

  What are the different technologies involved in this application?

• •

  Who would want to attack this application?

• •

  What would any attacker hope to gain by attacking the application?

• •

  What is the risk associated with a successful attack?

• •

  (and perhaps most importantly) How are the developers protecting this application?

In addition to an analysis of these security issues, a properly-performed static code analysis must also consist of (Graff & Van Wyk, 2003):

• •

  Type checking: this is usually done by the compiler and refers to the process of examining a program’s variables and parameters to ensure that a variable is not assigned to an incompatible type (Wysopal et. al, 2006);

• •

  Style checking: this consists of examining the format of the code, such as indentation and the use of comments, to ensure readability;

• •

  Program verification: this step consists of comparing a block of code with its task specification to ensure that the code is correct and generates the correct results (Howard & Lipner, 2006);

• •

  Property checking: this step seeks to ensure that particular sequences of instructions do not occur, such as accessing a memory location after it has been released or prematurely releasing all of a program’s allocated memory (Graff & Van Wyk, 2003);

• •

  Bug finding: this step involves scanning the code for patterns of commands to identify where a programmer may have inadvertently left out some intended code (Graff & Van Wyk, 2003);

• •

  and of course, the security review

Security review is one of the most important parts of a static code analysis. If a program is insecure and causes sensitive data to be released, it could have catastrophic consequences for the program’s developers. Several key security problems that should be addressed during a security review (Wysopal et. al, 2006) are those related to input handling, errors and exceptions, and buffer/integer overflow.